ToolFence: Task-Scoped Security for AI Agents

ToolFence is a task-scoped security gateway for AI coding agents, built for the IBM Bob 2.0 Hackathon. Its goal is simple: let an AI agent remain useful without giving it unrestricted access to repositories, CI systems, tickets, deployments, or secrets. Instead of granting broad permissions, ToolFence lets IBM Bob reason about the minimum capabilities required for a task. Bob submits a task-specific permission proposal, while a separately trusted developer-defined approval ceiling remains hidden from the model. ToolFence validates the proposal, activates the resulting policy, and then checks every protected tool call before execution. The MVP exposes 11 protected capabilities across tickets, repositories, pull requests, CI, releases, and secrets, plus 4 ToolFence control-plane tools. The system is designed to fail closed: if there is no active policy, a tool is not granted, a resource is outside scope, or arguments are invalid, the action is denied and not forwarded to the backend. Our golden demo uses the task: “Fix BUG-17, run CI, and create a pull request.” ToolFence grants only 6 of 11 available capabilities. A forbidden secret.read request is denied with TOOL_NOT_GRANTED, while the legitimate workflow succeeds through ticket.get, repo.read, repo.write, ci.run, ci.status, and pull_request.create. ToolFence also includes append-only audit logging, runtime policy snapshots, a read-only FastAPI observability layer, and a routed React security dashboard showing policy state, capability boundaries, activity, audit evidence, and benchmark results. In our replay benchmark, ToolFence matched 16/16 cases, blocked 100% of forbidden actions, achieved 0% false denials, 100% boundary-case accuracy, and reduced the active privilege surface by 45.45%. The core principle is: Bob reasons. ToolFence enforces.